Before
Analysts likely reviewed audit notifications in the Microsoft Purview portal, separated subscription messages from real events, and looked up full event details using the supplied identifier. They then determined the workload and manually passed the event to the appropriate analysis process, creating repeated tool changes and handoffs.
How it works
- Receive the Microsoft 365 audit webhook and automatically distinguish validation notifications from actionable audit events.
- Retrieve and format the full event details using the supplied content identifier.
- Compare the workload and dispatch the event to the corresponding Azure Active Directory, OneDrive, or Exchange analysis subflow.
Workflow details
- Event intake and validation: The workflow receives Microsoft 365 audit notifications through a secure webhook and distinguishes ordinary audit events from subscription-validation messages. Validation requests are handled by returning the provided validation code instead of sending them for analysis.
- Event enrichment: For a valid audit event, the workflow uses the event content identifier to retrieve the full event details from the Office 365 activity feed and formats the returned data as a JSON payload for downstream processing.
- Workload-based routing: The workflow checks the event workload and sends the complete payload to the corresponding Azure Active Directory, OneDrive, or Exchange analysis subflow. This creates a consistent handoff without requiring an analyst to determine which analysis process should receive each event.
- Operational result: The selected analysis subflow receives the event for deeper investigation, while the originating flow returns the identified workload as its output. The design supports continuous monitoring of Office 365 audit activity as events arrive.
What changed
Each valid audit event is enriched and routed automatically as it arrives, rather than waiting for an analyst to review and forward it. Workload checks now determine the destination subflow, while human review can focus on the analysis performed downstream instead of basic event dispatch.
Work removed
Reviewing audit notifications one by one, separating validation messages from actionable events, retrieving full event details, identifying the event workload, copying event data, and manually forwarding it to the correct analysis subflow.
Expected outcome
At least one manual triage-and-routing cycle is removed for each valid audit event, providing continuous, consistently directed coverage across the configured Office 365 workloads.
